Security ratings platforms scan what a company exposes to the internet and turn the findings into a score or grade that can be tracked over time.
This guide ranks eleven, from small European agencies to US names. Order follows set-up effort, the bill as vendor counts grow, data exit, partner dependence and buyer fit; each entry says what it lacks.
A vendor may pay to be more visible here. The wording of its entry, criticism included, stays ours, and no click on a vendor link pays us. How that works.
In short
What security ratings platforms do
Security ratings platforms score an organisation's cyber hygiene from outside-in observations such as exposed services, certificates, email authentication and leaked credentials, then refresh it so buyers can monitor suppliers continuously.
We ranked the 11 security ratings platforms on setup effort first, then total cost, then data export, then exit, then fit for the buyer. One rule overrides the order: smaller vendors take the first three places when the category offers them, and the best-known brands start at four. Why those five, and why there is no score out of ten, is on the how we work page.
Single and portfolio cyber-risk reports from a London company
Ranked #1 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestEurope
Use the online company scan first, bearing in mind the limit of five scans per visitor, then take the two-week trial with a real portfolio of domains. Compare each report with your own scanner on the same hosts, looking at the five check modules.
Ask how the peer group behind the comparison is chosen and what an annual contract adds beyond the trial. The operating company on its terms is Zen Risk Limited.
What stands out
Portfolio reports
Insurer focus
2-week trial
Where it costs you
The site gives no price for Breach Check, only a sales contact and a trial.
Questionnaires and supplier onboarding are absent from the product description, so a procurement team would add another tool.
Right for
Insurers, brokers and investors screening many companies from a list of domains
Wrong for
Procurement teams wanting questionnaires and supplier engagement in one workflow
United KingdomContact sales for Breach Check; 2-week trial, no payment details
Automatic 0 to 100 cyber ratings from a Paris rating agency
Ranked #2 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestEurope
Ask for a demo with three suppliers you already know well and read each control's detail against what your own team sees.
The same algorithm is applied to every company, so ask how often it recalculates and where its data comes from, because the pages name neither. The legal notice shows a share capital of 30,000 euros and a Paris registration. Settle the price before any pilot starts.
What stands out
0-100 scale
Nothing to install
Industry benchmarks
Where it costs you
Price, trial and data sources are absent from the pages, so cost and coverage are known only after a demo.
The pages cover ratings and remediation guidance but name no questionnaire, ticketing or integration features.
Right for
Buyers who want a plain numeric rating and an industry comparison, installing nothing
Wrong for
Teams needing assessments, workflows or integrations around the score
Cyber risk scores checked against insurance claims by Gallagher Re
Ranked #3 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestEurope
Read the Gallagher Re summary on the scoring page before the demo, and ask for the full study, since the site quotes two findings: 3.2 times for ransomware and 2.3 times for other attacks.
Use the trial portal with a handful of suppliers and check its third-party heat map against your own register. Ask which quote lines are ratings and which are consulting, and whether the DORA, NIS2 and ISO 27001 mappings are in the base licence.
What stands out
Gallagher Re study
Threat-led score
Insurer clients
Where it costs you
The score scale and the count of rated companies are missing from the pages we could read.
Testing, advisory and training sit next to the ratings, so a ratings-only buyer must scope the quote line by line.
Right for
Insurers and UK regulated firms wanting a score tied to claims evidence
Wrong for
Buyers who need published prices and a stated score scale
United KingdomPricing not stated; trial sign-up and demo
Listed annual tiers, a 0 to 900 score and AI agents
Ranked #4 of 11 in Best Security Ratings Platforms in 2026.
Published pricingEurope
Count vendors the way the pricing page does: a parent and its subsidiaries are one vendor unless you manage them separately, and exceeding a tier leads to a move at renewal. Book a SnapShot on one live supplier before signing, since the vendor runs it without commitment.
Compare Essentials, limited to 25 assessments a year, with Professional at 200. Ask what its agents may decide alone, because the plans separate manual, assisted and autonomous modes.
What stands out
0-900 score
Tiers by vendor count
32 AI agents
Where it costs you
The entry tier costs a five-figure annual sum, and fourth-party monitoring, the API and smart tiering wait for the higher tiers.
The vendor itself says a rating cannot see internal controls, and its cadence is daily or weekly scans, not real time.
Right for
Programmes of 50 to 150 vendors wanting a listed price before sales calls
Wrong for
Small teams monitoring a handful of suppliers on a modest budget
United KingdomPublished annual tiers by vendors monitored; unlimited user seats
CyberScore grades per hostname, capped at 50 subdomains
Ranked #5 of 11 in Best Security Ratings Platforms in 2026.
Free tierPublished pricingEurope
Run CyberScore on your own domain and two suppliers, then read how the grade is built: each hostname gets a letter, parked or unreachable hosts are excluded, and dark web exposure appears as incident counts, not a letter.
Check the limits before relying on it: 10 tests a month anonymously, 25 with an account, and 50 subdomains in the overview. If you need more, request Discovery and compare package scopes on its buy-online page.
What stands out
Free CyberScore
A+ to F grades
Geneva company
Where it costs you
Anyone holding the link can open a report, so sharing a supplier's grade means sharing it with every recipient of that link.
Monthly test limits and the 50-subdomain cap push portfolio monitoring onto the paid Discovery product.
Right for
Security teams wanting a no-cost first grade of a supplier web perimeter
Wrong for
Buyers monitoring hundreds of vendors through one dashboard workflow
SwitzerlandFree CyberScore ratings; Discovery packages published in euros per month
Standards-based ratings with ransomware likelihood and Open FAIR loss estimates
Ranked #6 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestNorth America
Start the demo with a vendor that already had an incident and see whether the index flagged it. Ask which module covers your need: Monitor for ratings, Assess for assessments and questionnaires, Extend for nth-party visibility.
Try the Open FAIR quantification with your own revenue and asset inputs, since a financial figure is only as sound as its inputs. The Terms of Use name NormShield Inc. dba Black Kite Inc. as the site operator.
What stands out
Open FAIR
Ransomware index
40M+ companies
Where it costs you
Monitor, Assess and Extend are separate modules, and the site gives no price for any of them.
The ransomware-index ratio comes from the vendor's own data and cannot be reproduced without account access.
Right for
Risk teams wanting loss figures and ransomware likelihood beside vendor ratings
Wrong for
Buyers wanting a free scan or a listed price before a demo
United StatesPricing not stated; demo booking only
Outside-in ratings sold under Mastercard, with a 50-vendor trial
Ranked #7 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestNorth America
Take the 30-day trial, load your 50 most important suppliers and compare asset attribution with your own records, since the accuracy claim concerns assigning assets to the right company.
Read the End User License Agreement dated May 2025 before signing, because it says which Mastercard affiliate contracts with you by region. Ask how the product relates to the other Mastercard cyber offerings in the menu, and whether they are quoted together.
What stands out
Mastercard terms
30-day trial
Asset attribution
Where it costs you
Purchasing runs through Mastercard agreements, which matters to buyers avoiding large payment-network groups.
The site routes buyers to sales or a demo request, with no listed price at any level.
Right for
Enterprises wanting a trial on 50 real vendors before commercial talks
Wrong for
Buyers who want an independent, single-product vendor company
United StatesSales contact only; 30-day trial covering up to 50 vendors
Ratings merged with questionnaires and business context in one workflow
Ranked #8 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestMiddle East
Open the trial account with five suppliers and see what the questionnaire changes compared with the external view alone; the vendor states that answers and certifications are used to validate findings.
Request the Ratings Transparency page that the product page links to for the Cyber Posture Rating method. Then line up the three evaluation bundles (Inventory, Assessment, Monitoring) against the three plans and decide which you would keep paying for after twelve months.
What stands out
Risk DNA
Questionnaires
Evaluation bundles
Where it costs you
Pages do not explain how questionnaire answers, attack-surface findings and inherent risk combine into the score.
Everything is quoted, and the sign-up links leave the content of the trial unstated.
Right for
Programmes that want ratings, supplier questionnaires and remediation follow-up in one tool
Wrong for
Buyers who only need an outside-in score and no workflow
Listed monthly entry plan, plus a no-signup A to F score
Ranked #9 of 11 in Best Security Ratings Platforms in 2026.
Published pricingAsia-Pacific
Type your own domain into the instant score first, then open the trial and enter the suppliers you currently track from your spreadsheet.
Compare that number with the 50, 150 and 500 vendor caps, and note the admin seats (6, 6 and 10 on the first three tiers) against unlimited read-only users. Breach Risk, User Risk and Trust Exchange show no price on the page, so ask what each adds to the quote before you sign.
What stands out
Standard plan listed
50-vendor entry
Instant Security Score
Where it costs you
Fifty vendors and six admin seats is the ceiling of Standard, after which you pay quoted rates.
No trial length is stated, and extras such as Trust Exchange have no visible price.
Right for
Mid-sized supplier programmes that want a starting price they can read and a fast trial
Wrong for
Programmes above 500 vendors that expect a single list price
AustraliaPublished entry plan billed annually; higher tiers quoted; trial
A to F ratings across 10 categories, priced by organisation count
Ranked #10 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestNorth America
Start with the free account on your own domain, which shows the scorecard the way suppliers see it and lets any number of colleagues view it. Next ask sales which of Watch, Assess and Secure matches your workflow and whether TITAN MAX is required.
Pricing counts organisations, so list each parent company and subsidiary on its own line before asking for a quote. Because scores move continuously, also find out what the dispute route is for a rating a supplier challenges.
What stands out
A-F ratings
TITAN packages
Own-domain account
Where it costs you
Nothing is priced publicly and the quote grows with each organisation tracked.
Managed questionnaires, monitoring and response come as TITAN MAX, a separate purchase from the three packages.
Right for
Large supplier portfolios that want managed questionnaire and incident work bought in the same contract
Wrong for
Small programmes that want a price list before any call
United StatesQuoted by organisations managed; trial, then a basic account
Security ratings vendor whose public pages we could not read
Ranked #11 of 11 in Best Security Ratings Platforms in 2026.
Pricing on requestNorth America
Use this entry as a signpost, not a review. Book the demo through the registration link on the customer login page and bring a written list: which scale rates a company, how fresh the scores are, how many organisations are covered and what separates the packages.
Ask the readable vendors above the same list and keep the answers side by side. The only contracting name we saw is Bitsight Technologies, Inc., and no trial was mentioned on pages we could open.
What stands out
Pages blocked
Demo registration
Unverified plans
Where it costs you
Our checks never got past a bot screen, so nothing about scope or limits is confirmed here.
No price and no scale were visible, which leaves a sales quote as the only basis for comparison.
Right for
Teams that already have Bitsight on a shortlist and will test its scope in a demo
Wrong for
Anyone looking for verified figures on this page
United StatesPricing not stated on readable pages; demo registration
Security ratings platforms score an organisation's cyber hygiene from outside-in observations such as exposed services, certificates, email authentication and leaked credentials, then refresh it so buyers can monitor suppliers continuously. These are the questions that actually differ between vendors, in the order we would ask them.
01
Check who publishes a price
Only 3 of the 11 print a price; 8 quote per organisation. Comparable without a sales call: RiskXchange, ImmuniWeb, UpGuard.
02
Look at where the vendor sits
4 regions are represented (Europe 5, North America 4, Asia-Pacific 1, Middle East 1). A vendor outside your own legal area is not a problem as such, but it changes who can compel it to hand over data.
Know what an outside-in rating cannot see
A rating is built from what anyone can observe: exposed services, certificate and email settings, leaked credentials. RiskXchange states the limit itself, saying a rating cannot see encryption at rest, segmentation, privileged access, staff training or backup testing, and so it pairs the score with the vendor's questionnaires and certificates.
Panorays follows a similar route by merging questionnaires and inherent risk into Risk DNA, while CYRATING keeps to a non-invasive scan with nothing to install. Decide before shortlisting whether you want a score alone, as a screening signal, or a score tied to evidence a supplier supplies. The second choice costs more setup time but answers fewer arguments with suppliers who dispute their grade.
Is the score a screen, or the basis for a decision?
Which controls matter that no scan can observe?
Who handles the supplier whose grade drops?
Compare the unit and the cap, not the headline price
Vendors meter different things. RiskXchange lists annual tiers by vendors monitored, 50, 150 and unlimited, with unlimited user seats. UpGuard lists a Standard plan for 50 vendors and quotes the tiers above it for 150, 500 and unlimited. SecurityScorecard prices by the number of organisations managed.
Black Kite, Orpheus Cyber and CYRATING state no price at all, and RiskRecon lets you try 50 vendors for 30 days before any quote. Put your real vendor count, including subsidiaries, in front of each seller and ask how a parent company and its children are counted, because that definition moves the bill more than the headline figure does once the programme grows past its first year.
How does the vendor count parents and subsidiaries?
What happens when you pass the tier cap?
Are admin seats limited or unlimited?
Try a free or trial rating on suppliers you know
Several vendors let you test before any call. ImmuniWeb CyberScore needs no registration, allows 10 new tests a month and 25 with an account, and covers up to 50 subdomains. DynaRisk offers a two-week Breach Check trial without payment details, and UpGuard shows an A to F score without signup. SecurityScorecard keeps a free account for your own domain.
Use the trial on three suppliers whose weak spots you already know, plus your own domain, and write down which known weakness each product finds. A rating that misses an exposure you can see yourself, or credits a retired subdomain as a failure, will not survive a supplier dispute, and you want to learn that before the contract is signed.
Does it find a weakness you already know about?
How does it treat parked or retired hosts?
Can you export the report without sharing a public link?
Check the scale and the evidence behind it
Scales differ, so grades cannot be compared across vendors. CYRATING uses 0 to 100, RiskXchange 0 to 900 with an A to F label, SecurityScorecard A to F across 10 categories, and ImmuniWeb A+ to F per hostname, averaged. Evidence differs as well.
Orpheus Cyber cites a Gallagher Re study of 47,000 organisations tying its scores to ransomware claims, and Black Kite publishes a ransomware index with its own ratio. Ask each seller for the method in writing, and for the date the figure was produced. Bitsight is a reminder of the limit of desk research: its public pages block automated reading, so its scale is something to confirm in a demo.
Is the scale and method written down?
Is the validation study available in full?
How often is the score recalculated?
What goes wrong most often when buying security ratings platforms
Treating a letter grade as proof of safety, when the vendor itself says it sees only the outside of the company.
Comparing a Standard plan price with a quote that counts organisations, without checking what each unit includes.
Rating a supplier with a tool whose report link is open to anyone, then forwarding that link without thinking about who receives it.
Buying a platform for its questionnaire features and then using only the score, or the reverse.
07
Frequently asked questions
6 answers
What are the best security ratings platforms in 2026?
Our ranking of 11 puts DynaRisk first. Breach Check scans one domain, or an uploaded list of domains, for exposed services, outdated software, leaked records, infostealer hits and hacker chatter, then writes a report with fixing tips and a comparison against similar businesses.
It is aimed at insurers, brokers and fund managers, so supplier questionnaires are not part of what it describes. No price is listed, and the online scan stops after five per visitor.
Which security ratings platforms publish their pricing?
3 of the 11, with the pricing model each one publishes:
RiskXchange: Published annual tiers by vendors monitored; unlimited user seats.
ImmuniWeb: Free CyberScore ratings; Discovery packages published in euros per month.
UpGuard: Published entry plan billed annually; higher tiers quoted; trial.
Everything else on the list is priced on request.
Is there a free security ratings platform?
ImmuniWeb have a free plan or free self-hosted edition.
Where are these security ratings platform vendors established?
In 6 countries across 4 regions: Europe 5, North America 4, Asia-Pacific 1, Middle East 1.
DynaRisk: United Kingdom.
CYRATING: France.
Orpheus Cyber: United Kingdom.
RiskXchange: United Kingdom.
ImmuniWeb: Switzerland.
Black Kite: United States.
RiskRecon: United States.
Panorays: Israel.
UpGuard: Australia.
SecurityScorecard: United States.
Bitsight: United States.
What should you use instead of DynaRisk?
The next in line are CYRATING, aimed at Buyers who want a plain numeric rating and an industry comparison, installing nothing, and Orpheus Cyber, aimed at Insurers and UK regulated firms wanting a score tied to claims evidence.
Who should not buy DynaRisk?
Procurement teams wanting questionnaires and supplier engagement in one workflow. The site gives no price for Breach Check, only a sales contact and a trial..
Vendors who think their security ratings platforms product should be here can tell us about it: what it does, who it is for. The call is ours, and software advice sets out what being listed means.
